In an enterprise Web service and service-oriented architecture (SOA) environment, user identity (e.g., user name and/or ID) is typically propagated across layers of different interconnected applications. When such user identity information is propagated from a Web service client to a Web service, the information is usually protected via a security mechanism (e.g., WS-SecurityPolicy) and is accompanied by an authentication token such as a Security Assertion Markup Language (SAML) token. With the SAML mechanism, an individual originating a service request (i.e., the subject) is authenticated via a local authentication service that the Web service client trusts. Once the subject is authenticated, the Web service client transmits the service request, along with a user identity, to the Web service. The request further includes an assertion (in the form of a SAML token) that the user identity is authentic. Generally speaking, the user identity that is transmitted in the service request is the identity of the authenticated subject.